CVE-2026-81491 in with-context-mcp
Summary
by MITRE • 08/27/2026
A flaw has been found in boxpositron with-context-mcp up to 3.0.7. This affects the function ingest_notes/teleport_notes/sync_notes/project_folder of the file src/index.ts. Executing a manipulation can lead to path traversal. It is possible to launch the attack remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified in boxpositron with-context-mcp versions up to 3.0.7 represents a critical security flaw rooted in improper input validation within the application's file handling mechanisms. Specifically, the defect resides in the ingest_notes, teleport_notes, sync_notes, and project_folder functions located in the src/index.ts source file. These functions are responsible for processing user-provided data that dictates where files should be stored or retrieved from on the underlying operating system. The core technical issue is a path traversal vulnerability, which allows an attacker to manipulate input parameters containing directory traversal sequences such as dot-dot-slash (../) to break out of the intended application directories and access arbitrary locations within the file system. This flaw stems from insufficient sanitization of user-supplied paths before they are passed to operating system calls that resolve file locations.
From a technical perspective, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory. When an application fails to properly validate or canonicalize input paths, it permits attackers to bypass access controls and read sensitive files outside the designated sandbox or working directory. In the context of boxpositron with-context-mcp, this could allow for the reading of configuration files containing credentials, private keys, or other secrets stored in parent directories. Furthermore, depending on how the application handles write operations within these functions, an attacker might potentially overwrite critical system files or inject malicious content into trusted locations, although the primary reported risk is unauthorized data access through traversal.
The operational impact of this vulnerability is severe due to its remote exploitability. Since the attack can be launched remotely without requiring prior authentication in many configurations, it significantly expands the attack surface. An adversary located anywhere on the network or internet could potentially probe these endpoints and execute path traversal attacks to exfiltrate sensitive data from the host system. The fact that an exploit has already been published increases the immediacy of the threat landscape, as automated scanning tools and malicious actors can readily leverage this known weakness against unpatched instances. This situation places organizations relying on this software at high risk for data breaches and potential compromise of broader infrastructure if the affected application runs with elevated privileges or accesses sensitive repositories.
Industry frameworks categorize this type of vulnerability under specific attack patterns that emphasize input validation failures. The ATT&CK framework identifies techniques related to Collection via File and Directory Discovery, where adversaries use system commands or scripts to gather information about files and directories on compromised systems. In this case, the path traversal serves as a mechanism for unauthorized discovery and extraction of data from restricted areas. Security professionals should treat this not merely as an application bug but as a significant vector for initial access or lateral movement if combined with other vulnerabilities within the same environment.
Mitigation strategies must prioritize immediate remediation given the availability of public exploits. The most effective solution is to upgrade boxpositron with-context-mcp to version 3.0.8 or later, where this path traversal issue has been addressed through improved input validation and canonicalization logic. Until an update can be applied, organizations should implement network-level controls such as web application firewalls that detect and block common path traversal patterns in HTTP requests targeting the affected endpoints. Additionally, restricting file system permissions so that the application process runs with minimal privileges necessary for its operation can limit the damage caused by successful exploitation. It is also advisable to monitor logs for unusual access patterns or attempts to traverse directories outside expected boundaries as an indicator of compromise while patching efforts are underway.